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A game-theoretic model for the study of dynamic networks is analyzed. The model is motivated 
by communication networks that are subject to failure of nodes and where the restoration needs 
resources. The corresponding two-player game is played between "Destructor" (who can delete 
nodes) and "Constructor" (who can restore or even create nodes under certain conditions). We also 
include the feature of information flow by allowing Constructor to change labels of adjacent nodes. 
As objective for Constructor the network property to be connected is considered, either as a safety 
condition or as a reachability condition (in the latter case starting from a non-connected network). We 
show under which conditions the solvability of the corresponding games for Constructor is decidable, 
and in this case obtain upper and lower complexity bounds, as well as algorithms derived from 
winning strategies. Due to the asymmetry between the players, safety and reachability objectives are 
not dual to each other and are treated separately. 

Keywords: infinite games, dynamic networks, fault-tolerant systems 



1 Introduction and Motivation 

A classical scenario for the application of game-theoretic methods in verification is the antagonism be- 
tween a possibly malicious environment and a system (or its control component) that has to guarantee a 
desired behavior given any choice of actions of the environment. The task of verification is then to show 
that in this game between environment and system the player system has a winning strategy, and in an 
ideal situation it should even be possible to generate such a winning strategy from the specification of 
the desired behavior (defined, e.g., in terms of a formula of temporal logic). 

The present paper pursues this view in a specific context that is of central interest in the theory of 
communication networks. We study the antagonism between "suppliers" and "users" of a communication 
network on one side and the generation of faults (either by nature or by malicious interference) on the 
other. So, we consider dynamic network games in which a game position is just given by a current shape 
of a network. The party that generates faults is modeled by a player called Destructor who can "delete" 
nodes in a network. In the present paper we only consider changes in the set of nodes (and induced 
changes in the set of edges). The more general case that arises when including edges in the dynamics 
involves heavier notation, but does not affect the general results as they appear in this paper. (More 
precisely, our framework is able to simulate edge deletions by modeling each edge as a vertex |[T5l .) 

The other parties involved are the suppliers of the network and the users. There are many ways 
to model these parties. We consider here a model that represents a compromise between conceptual 
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Figure 1: Movement of strong node with Figure 2: Creation of a new node by a set [/ = 

restoration. {mi , M2 , M3 } of strong nodes. 

simplicity and adequacy for practical application^. The aspect of simplicity is introduced by a merge of 
the two parties suppliers and users in a single player called Constructor. This player has the power to 
restore deleted nodes or even to create new nodes (i.e., to extend the network beyond its original shape), 
matching the purpose of a supplier, and she also can transmit information along edges of the network, 
matching the actions of an user. The latter feature is realized by the possibility to relabel two nodes that 
are connected by an edge. 

A detailed description of these possible actions by Destructor and Constructor yields a dynamic 
network game in which these players carry out their moves in alternation, step by step changing the 
shape and the labeling of the network. In the present paper we analyze these games only with one 
objective (winning condition for Constructor), namely with the objective to guarantee that the network is 
connected. The objective arises in two versions: as a safety game in which connectivity of the network is 
to be guaranteed forever by Constructor, or as a reachability game in which Constructor has to construct 
a connected network, starting from a disconnected one. Since we assume complete information, these 
games are trivially determined. Our aim is to clarify under which assumptions these games are effectively 
solvable, i.e., that one can decide who wins (and in this case to construct a winning strategy for the 
winner). One should note that by the independent and very different conceptions of the two players, 
there is no direct duality between reachability and safety objectives; both games have to be analyzed 
separately. On the other hand, a simplification is built into our model by our decision only to declare 
connectivity of the network as Constructor's objective, i.e., that the aim of the users to realize the transfer 
of information from certain source nodes to target nodes is not taken into account. (For a study of network 
games including this aspect, see the paper [ 14 1.) 

Before stating our results, let us sketch informally but in a little more detail the definitions of Con- 
structor's actions, which she chooses from a given set of rules. We distinguish three different types of 
rules. The first is concerned only with the "information flow" through the network evoked by the users; 
nodes and edges as such stay fixed. A natural way to describe this aspect is to assume a labeling of the 
nodes that may change over time. For instance, the label a on node u and a blank label on the adjacent 
node V are modified to the blank label on u and the label a on v, corresponding to a shift of the data a 
from u to V. Only the labels of adjacent non-deleted nodes can change; for the same reason as in com- 
munication networks only neighboring active clients are able to send or receive messages. A relabeling 
rule describes in which way Constructor may change labels of adjacent nodes. The other rules entail 
a changes to the network structure. Constructor can restore nodes, which could have existed before, or 
create completely new nodes. These steps involve the concept of "strongness" of a node: a strong node 
cannot be deleted, and it is the prerequisite for performing the restoration and creation of nodes. One 
can view strong nodes as maintenance resources of suppliers, which are located on some places in the 
network. The strongness property may be propagated through edges to existing nodes; being at some 

' We thank our colleagues in the research cluster UMIC (Ultra High-Speed Mobile Information and Communication) for 
their contributions in devising the current model. 
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game variant 

allowed rules 



objective 



reachability 



safety 



expanding 
all 

s-create, w-create, relabel 
s-create, move, relabel 
w-create, move 

non-expanding 

unlabeled 



undecidable 
undecidable 
undecidable 
undecidable 

PSPACE-hard / in ExpTlME 
NP-hard/inPSPACE 



undecidable 
in ExpTime 
PSPACE-complete 
open 

PSPACE-complete 
PSPACE-complete 



Table 1: Summary of our results; for expanding games, we distinguish whether Constructor is allowed 
to create strong nodes (s-create), create weak nodes (w-create), move strong nodes, or relabel nodes. 



node u it can also be used to restore a deleted node v by moving to it if there was an edge (m,v) in the 
network before the deletion of v (see Figure [B. For the creation of a node we can pick some set S of 
strong nodes, create a new node v (that is or is not strong) and connect it by an edge with each node in S 
(see Figure This corresponds to the assumption that creation is "more expensive" than restoration. In 
our framework, both actions are either feasible in general or subject to constraints given by the labels of 
the involved nodes; we will collect these constraints in movement and creation rules. 

Our results clarify the solvability of these connectivity games in several versions, complementing a 
result of II20I that the reachability problem (to reach a connected network by Constructor) is undecidable 
in the cases where the creation of new nodes is allowed. Our first results say that for safety games 
solvability (for Constructor) is undecidable in the general case but - maybe surprisingly - decidable 
when either creation of new non-strong nodes is disallowed or movement of strong nodes is disallowed. 
The former problem is PSPACE-complete, the latter is solvable in ExpTlME (where the input size is given 
by the size of the initial network and the size of the rule set of Constructor). Also in those restrictions 
where creation of nodes or relabeling is completely disallowed we sharpen the results of [20] (where 
PSPACE-hardness was shown) in obtaining PSPACE-completeness. 

For the last mentioned restriction (no creation of nodes, no relabelings), we finally obtain partial 
results by providing lower and upper bounds; the proofs illustrate again the difference between safety 
and reachability. We show that under the first restriction solvability by Constructor is PSPACE-hard 
(while the easily obtained upper bound is ExpTlME), and for the second restriction (no relabelings) this 
solvability is in PSpace and NP-hard. An overview of the results is given in Table [T] 

The paper is structured as follows. In the sequel of this introduction we discuss related but technically 
different approaches to network games. Section |2] introduces the model in detail. Section [3] offers the 
results on safety games, whereas in Section |4]the solvability of reachability games is studied. We finish 
by listing some selected perspectives from a very rich landscape of problems that remain to be treated in 
this area combining practical issues with theoretical research. 

Related Work. Our game model was introduced in f20l; we sharpen and extend these preliminary 
decidability and complexity results. The game-theoretic approach is inspired by sabotage games, which 
van Benthem suggested in |3|. There, a reachability problem over graphs is considered, where a "Run- 
ner" traverses a graph while a "Blocker" deletes an edge after each move. The theory of these games and 
many variants have been thoroughly studied in lITSlllSlfTTlfTTll . 
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Dynamically changing systems are also addressed by online algorithms (see lU lU). These find 
applications in routing and scheduling problems in wireless and dynamically changing wired networks 
(see |[2T1 l25l ). However, the only approaches we are aware of where the adversarial also changes the 
network structure is due to Awerbuch et al. lH] |2]; there a routing objective is faced with an adversary 
that injects packets and also decides which connections are available. These studies aim at a competitive 
analysis of the "communication throughput": the number of delivered packets of an online algorithm is 
compared to an optimal offline algorithm. 

Another view on online algorithms are dynamic algorithms (see EUl). A fully dynamic algorithm 
refers to a dynamic graph in which edges are inserted and deleted; the focus of investigation is the 
computational complexity of static graph properties with respect to a given sequence of update steps 
(see |[T6l l22l). The same idea leads to a dynamic complexity theory, which deals with the complexity of 
computing and maintaining an auxiliary structure; this structure entails the solution of a decision problem 
for a dynamically changing instance (see ||27| ). 

Studies on a game-theoretic model for routing under adversarial condition have been started in 
Instead of a competitive analysis of a given online algorithm, the aim is to check whether a given dynamic 
scenario has a solution in form of a routing scheme (and to synthesize a routing scheme if it exists). 
This model is also inspired by the sabotage game model, but complementary to the present work. The 
adversary deactivates edges and injects packets in the network, and a solution of the game requires that 
all packets must be delivered or that the overall number of packets in the network is bounded. 

Another interesting approach arises from the studies of dynamic versions of the Dynamic Logic of 
Permission (DLP), which is in turn an extension of the Propositional Dynamic Logic (PDL). In DLP, 
"computations" in a Kripke structure from one state to another are considered which are subject to 
"permissions" [19|. The logic DLPj^j^ (see |!6lfl2l) extends DLP with formulas which allow updates of 
the permission set and thus can be seen as a dynamically changing Kripke structure. Nevertheless, all 
the dynamics have to be specified in the formula; an adversarial agent is not considered. 

The idea of changing networks is of course studied in considerable depth in the theory of graph 
grammars, graph rewriting, and graph transformations (see fUlM]). While there the class of generable 
graphs (networks) is the focus of study, we deal here with the more refined view when considering the 
evolvement of a two-player game and the properties of graphs occurring in them. In the (one-player) 
framework of model checking, we mention the work flOl, where graph-interpreted temporal logic is 
introduced as a rule-based specification. A technique is developed to map a "graph transition systems", 
which nodes are graphs, to a finite Kripke structure, so that classical LTL model checking can be apphed. 

2 Dynamic Networks via Games 

We present networks in the form G = (y,E,A,S, {Pa)aei:) with 

• a finite set V of vertices (also called nodes), 

• an undirected edge relation E, 

• a set A C V of active nodes, 

• a set 5 C A of strong nodes, 

• a partition of V into sets Pa for some label alphabet £. A node belongs to Pa if it carries the label a. 

We say that a node is deactivated or deleted if it is not active. A weak node is an active node which is 
not strong. A network is connected if the graph that is induced by the active vertices is connected, i.e., 
for any two active vertices u,v there exists a path from m to v which only consists of active nodes. 
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The dynamics of a network arises by the possible moves of two players, Destructor and Constructor, 
which are changing the respective current network. A dynamic network game will be presented as a pair 
^ = {G,R) consisting of an initial network G as above and a finite set R of rules for Constructor. The 
two players play turn by turn in alternation; Destructor starts. Both players are allowed to skip as well. 

Let us describe the rules that define the players' possible actions. When it is Destructor's turn, he can 
perform a deletion step by deleting some weak node v G A \ 5; the set A is changed to A \ {v}. When it 
is Constructor's turn, she can choose a rule from her rule set R that is applicable on the current network. 
The rules in R can be of three different types. 

Relabeling rule: A rule {a,b — > c,d) allows Constructor to change the labels a and b of two active 
adjacent nodes of A into c and d, respectively. Formally, for two vertices u e Pa and v e Pb with 
(m, v) G E the sets Pa, Pb, Pc, and P^ are updated to Pa \ {u}, Pb \ {v}, Pc U {u}, and P^ U {v}. 

For relabeling rules we will also consider rules with multiple relabelings in one turn. This corre- 
sponds to our intuition that there can be a lot of information flow in the network at the same time. 
For example, for two relabeling steps in one turn we use the notation {a,b — > c,d ; e,f — > g,h). 
The relabelings are applied one after the other, but in the same turn. 

Movement rule: A rule ( a '"°''^> b ) allows Constructor to shift the "strongness" from a strong node that 
carries the label a to an adjacent node that is labeled with b and must not be strong. Formally, for 
two vertices u^Pa and v G P/, with m G 5, v ^ 5, and (m, v) G E, the set S is updated to {m}) U {v} 
and A is updated to A U { v} . The case v G A means to simply shift strongness to v ; the case v G V \ A 
means restoration of v. The terms "moving a strong node" and "shifting its strongness" are used 
interchangeably through the paper. 

Creation rule: These rules enable Constructor to create a completely new node, which is not in y. A 
rule {ai,...,a„ '^^^'•"^ a[,...,a'„) allows Constructor to choose any set U = {u\,.. .,u„} C 5 of 
n different strong nodes such that the label of m; is a,- (for all / G {1, . . . Then, Constructor 
creates a new active node w, labels it with c, and connects it to every node in U. Formally, the 
sets V and A are updated to V U {w} and A U {w}, respectively; also E is updated by adding edges 
between w and each node of U. Also the labels of the nodes in U may change after creation; the 
label of Ui is changed to a- (for all / G {1, . . . ,n}). For the creation of a strong node we use the 
notation (ai , . . . ,a„ ^ "'^'^^'^'■"^ a[,...,a'„).hi this case also 5 is updated to 5U {w}. 

We consider some variants where Constructor's moves are restricted. A game {G,R) is called non- 
expanding if R does not contain any creation rule. In unlabeled games nodes cannot be distinguished by 
theirs labels; formally, we assume that all vertices are labeled with a blank symbol lj and the movement 
rule ( L_i i^^2I£). ^ ^ is ^iig only available rule. 

A play of a game is an infinite sequence ;r = G1G2 • • • where Gi is the initial network and each 
step from G; to Gj+i results from the moves of Destructor (if / is odd) and Constructor (if / is even), 
respectively. So, plays are infinite in general, but may be considered finite in the cases where neither 
of the players can move, or a given objective (winning condition) is satisfied. In this paper we consider 
dynamic network connectivity games, where Constructor's objective concerns the connectivity of the net- 
work (more precisely, of the active nodes). We distinguish between connectivity games with reachability 
objective and safety objective. In the former the initial network is disconnected, and Constructor's objec- 
tive is to reach a connected network; conversely, in the safety game the initial network is connected, and 
Constructor has to guarantee that the network always stays connected. If Constructor achieves the given 
objective in a play 7i, she wins n with respect to this objective. 
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Si Ml V2 W2 W3 



Figure 3: An example initial network (bold nodes are strong). 

A strategy for Destructor is a function (usually denoted by a) that maps each play prefix GiG2 - Gk 
with an odd ^ to a network Gk+\ that arises from Gk by a node deletion. Analogously, a strategy for 
Constructor is such a function (denoted by t) where k is even and Gk+i arises from Gk by applying one 
of the rules from R. A strategy is called positional (or memoryless) if it only depends on the current 
network, i.e., it is a function that maps the current network Gk to Gk+\ as above. If Constructor has a 
strategy T to win every play, where she moves according to T, with respect to the reachability (safety) 
objective. Constructor wins the reachability (safety) game; Destructor wins otherwise. This leads us to 
the following decision problems. 

• Dynamic reachability problem: Given a dynamic network game does Constructor have a strat- 
egy to win the reachability game (i.e., eventually a connected network is reached)? 

• Dynamic safety problem: Given a dynamic network game does Constructor have a strategy to 
win the safety game §^ (i.e., the network always stays connected)? 

In this paper we only consider reachability and safety objectives. For these winning conditions it is 
well known that one can restrict winning strategies of both players to positional strategies ll26][T3l . i.e., 
if Constructor (Destructor) has a strategy to win a given game she (he) also has a positional strategy 
to win ^. Therefore, we will always assume positional strategies in this paper. 

Example 2.1. We consider a dynamic network connectivity game ^ = {G,R) with labels _L,u € £. The 
initial network G = (y,E,A,S,{Pa)aei:) with the set S = {s\,S2,u\,w\} of strong nodes is depicted in 
Figure |3] We consider the safety game where the only rule in /? is '"°™> lj). It means that the 
strong nodes s\ and are not able to move, because their labels do not match the movement rule. 
Constructor has to guarantee the connectivity of the network. As a scenario for this game one could 
imagine two clients s\^S2 communicating over a network with unreliable intermediate nodes but two 
mobile maintenance resources (initially located on u\ and vi). 

By taking a closer look at this example we see that Destructor has a winning strategy. He deletes W3 
in his first move; then we distinguish between two cases: if Constructor restores W3, Destructor deletes 
vi in his next move and finally u\ or V2; if Constructor does not move the upper movable strong node 
to W3, this node has to remain at wi; otherwise Constructor loses by deletion of wi. In the second case it 
is easy to see that Destructor wins by suitable deletions of nodes in {mi,M2,vi,V2}. 

Now we consider the same game, but additionally with the creation rule (u,^ cieate(Lj)^ We 
claim that now Constructor has a winning strategy. If Destructor deletes the node vi or V2 Constructor 
creates a new vertex V3 with the creation rule which establishes a new connection between the two strong 
nodes u\ and w\. If Destructor deletes the new vertex V3 Constructor creates a new vertex again, and so 
on. Note that in this way the number of vertices in the set V can increase to an unbounded number. 
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3 Results for Safety Connectivity Games 

The general case. In this section we analyze the dynamic safety problem, for which we show in our 
first result that it is undecidable in general. It is indeed remarkable that we have to assume the presence 
of weak creation, movement, and relabeling rules to show this. Later we will see that the dynamic safety 
problem becomes decidable if weak creation or movement rules are absent. 

Theorem 3.1. The dynamic safety problem is undecidable, even if Constructor can only apply weak 
creation, movement, and relabeling rules. 

Proof. We use a reduction from the halting problem for Turing machines. These are w.l.o.g. presented 
in the format M = (2,r, 5,<7o,^stop) with a state set Q, a tape alphabet F (including a blank symbol u), 
a transition function 5 .Q\ {^stop} x F ^ 2 x F x {L,/?}, an initial state <7o, and a stop state ^stop- 

For a Turing machine M we construct a game = {G,R) such that M halts when started on the empty 
tape iff Constructor is not able to keep the network always connected by applying the rules of R, i.e.. 
Destructor wins the safety game ^. The idea is to consider a configuration of M as a connected network 
where Constructor creates additional vertices during the simulation of a valid computation of M. If M 
stops, she cannot create vertices anymore, and Destructor is able to disconnect the network. We label 
the nodes that correspond to a configuration of M with triples of the from F x (QU {L,/?}) x {|,]} with 
2 := 2 X {0, l,<i,i>}. The first component holds the content of its represented cell of the tape. The 
second component is labeled with L or /? if the represented cell is on the left-hand side of the head or 
on the right-hand side of the head, respectively; the second component is labeled with q £ Q and some 
auxiliary symbol if M is in state q and the head is on the cell represented by this node. The third element 
is either an end (] ) or an inner marker ( | ) depending on whether the node is the currently the right-most 
represented cell of the tape or not. Additionally, the label alphabet contains the symbols T, _L, +, and !. 
The labels T, _L are used for the two additional strong nodes that Constructor has to keep connected; the 
_L-labeled node is always connected to every cell node while the T-labeled node is only connected to the 
_L-labeled node via some weak nodes that are labeled with +. The exclamation mark (!) is used as a label 
that Destructor has to prevent to occur; if Constructor manages to relabel a strong node to a ! -labeled 
node, she has a winning strategy regardless of the behavior of M. 

Constructor has to create a +-labeled weak node in every turn where she simulates a transition of M. 
Since we want Constructor to simulate only valid transitions, we ensure that an according creation rule 
can only be applied to the cell node that holds the current state of M and an adjacent cell node. For this 
reason only two cell nodes are strong at any time. Constructor is able to shift these nodes depending 
on whether Constructor wants to simulate a left or a right transition of M. We ensure that Constructor 
shifts the nodes at most once between simulating two transitions; otherwise she would be able to shift 
them forever instead of simulating M. For this reason the cell node representing the head has auxiliary 
symbols in {0, l,<i,i>}: the symbol means that Constructor can choose either to shift the strong nodes 
or to simulate a transition. If this symbol is 1 , she has already shifted the strong nodes and now must 
simulate a transition. The symbols <i and > are used as intermediate labels when Constructor shifts the 
strong nodes to the left or to the right, respectively. The initial network, which corresponds to the initial 
configuration of M on an empty working tape, is depicted in Figure |4] 

In the following we describe the rule set R. As mentioned before, the rule ( !,T,_L "^^'^'^'> !,T,_L) 
allows Constructor to ensure the connectivity of the network if a strong node obtains the ! -label. 

To allow Constructor to shift the two strong cell nodes to the right, we add the following rules for 
allqeQ,a,b£r,a.nd*£ {|,]}: 1. {{a,{q,0),\),T , ± °''^'"^') {a,{q,>),\),T , ±), 2. {{a,{q,>),\) 
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Figure 4: A game network representing an initial configuration of M. 



{b,R,*)), 3. {{a,L,\) ^ {b,{q,>),\)), and 4. {{a,{q,>),\,0),T ,± {a,{q,\),\),T The 

rules for shifting the two strong nodes to the left are built analogously. After the application of the 
second and the third rule, we want to force Destructor to deactivate the weak cell node (instead of a +- 
labeled node). For this reason we add the relabeling rule ( {a,L, \),{b, {q,z), |) — > !, ! ; \,{c,R,*) — > !, ! ) 
for every a,b,c £r, z. ^ {<,>}, and * G {[,]}■ An application of this rule is possible iff a series of three 
cell nodes is active; it leads to an [-labeled strong node and hence to a network where Constructor wins. 

A transition of M is simulated by changing the labels of the two strong cell nodes. One of the cell 
nodes has to carry, besides the state of M, the auxiliary symbol or 1 ; in this case it is guaranteed that the 
two strong cell nodes are adjacent. Due to the introduced move rules, we can assume that these strong 
nodes are already at their desired position. Then, it is easy to supply a set of creation rules that mimics 
the transitions of M. Formally, for each tuple {q,a,p,b,X) with 5{q,a) = {p,b,X) and for every c S F, 

z G {0,1}, and * G {],]} we add the rule {{c,R,\),{a,{q,z),*),T,± ^^^^ {c,{p,0),\),{b,R,*),T ,±) 
ifX = L,and((a,(^,z),|),(c,/?,*),T,±^^;^(Z7,L,|),(c,(p,0),*),T,±) ifX=R. 

Finally, rules are needed to extend the network in the case that more space on the tape is needed. New 
cell nodes are allocated next to the end marker, which represents the rightmost used cell of the tape. For 
this allocation we add the rule (_L, {a, (^,0),]) "^^^^"^^"^''"> _L, (a, (^,0), |) ) for every a G F, and q G Q. 
Destructor will deactivate the created node with the label (u,/?,]) immediately to prevent Constructor 
from relabehng a strong tape node to a ! -labeled node. 

To show the correctness of the construction, assume that M never stops. In this case Constructor can 
guarantee that there is at least one active +-labeled node, which connects the nodes labeled T and _L. 
One of the three +-labeled nodes in the initial network is deleted since Destructor starts. Destructor 
may delete another of these nodes if he misbehaves after some tape extension or a strong node shift and 
hence allows Constructor to obtain a strong !-labeled node. In each case Constructor wins. Conversely, 
if M stops. Constructor cannot apply any rule for simulating a transition from some point onwards. The 
construction ensures that Constructor can shift the strong cell nodes or create a new cell node at most 
once after simulating a transition. Hence, she can only skip from some point onwards, and Destructor 
wins by deleting all +-labeled nodes. □ 

Decidable Subcases. Now, we analyze safety games under some restrictions to the given rule set. If 
we prohibit weak creation rules, solving safety games is PSPACE-complete. The PSPACE-hardness also 
holds in the more restricted unlabeled case (see Theorem 13.71 ). Here, we show the inclusion in PSpace. 

We call a strategy of Destructor strict if he deletes a vertex in every turn (i.e., he does not skip) 
whenever there is still a weak node left for deletion. We can assume that Destructor always plays a strict 
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strategy in a safety game: if Destructor skips, so Constructor can skip as well leading the play to the 

same network (which is still connected). 

Remark 3.2. If Destructor wins a safety game W, he also has a strict strategy to win 

For a play ;r = G1G2 . . . we define the level of a network as the number of weak nodes in if 
Destructor acts next (i.e., / is odd) and as the number of weak nodes in G, minus 1 if Constructor moves 
next (i.e., i is even). Clearly, if Destructor plays according to a strict strategy, the level is monotonically 
decreasing as long as the level has not reached (or Destructor has won). 

Lemma 3.3. Consider a safety game ^ without weak creation rules. If Destructor wins ^, he also 
wins ^ with a strict strategy such that, for each I, Constructor is able to shift each strongness at most 
rifdi times in networks of level i (before a disconnected network is reached), where nn (dn) is the number 
of nodes (deactivated nodes) of the first occurring network of level I. 

Proof. Towards a contradiction, assume that Destructor has a strict winning strategy a, but Constructor 
has a strategy t where, for some I, she is able to shift a strongness more than ni • di times in networks of 
level i before Destructor wins. Consider a play K where Destructor and Constructor play according to c 
and T, respectively. So, there exists some I such that Destructor shifts a strongness at least «^ • t/^ + 1 times 
in networks of level I. Let G,- be the first network of level I in %, and let be the last network of level I 
in 71, where either Destructor has akeady won (i.e., Gk is disconnected) or Constructor's move decreases 
the level. Since weak creation rules, which preserves the level, are forbidden and Destructor's strategy (7 
is strict, we can assume that Constructor applies only movement rules in the play infix G; • • • G^ and hence 
the set of nodes and their labels are preserved in this play infix; applying a relabehng or a strong creation 
rule would immediately decrease the level to £ — 1. 

In the play infix G,- ■ • ■ Gy^ each strongness is shifted along a certain path of nodes, each of which must 
have been deactivated before Constructor shifts the strongness to it; otherwise the level would decrease 
to I — \ immediately. Among these deactivated vertices we distinguish, for each network in G,- • • • Gyt, 
between the nodes that have already been deactivated since G; and the nodes that have been deleted by 
Destructor in some network of level i at least once. As the network G; consists of di deactivated nodes, in 
the play infix G,- • • • Gi Constructor shifts a strongness at most di times to a node that has not been deleted 
by Destructor in some network of level I before. Since there is a strongness that Constructor shifts at 
least ni-di^X times in networks of level i, there is a play infix Gj^ ■ ■ ■ Gj^ of n with / < ji < j2 < k 
where a strongness is shifted in a loop such that the node where this strongness is shifted to has been 
deleted by Destructor before in some network of level £. Assume that this loop consists of m nodes. 

Since Constructor restores these m nodes, none of these m nodes stay deactivated until Destructor 
wins or the level decreases. It remains to be shown that Destructor does not have to delete all of these 
m nodes in order to prevent Constructor from applying a certain rule. By definition the m deleted nodes 
are restored by the same strongness; none of the other strong nodes has to be moved in order to restore 
them. The vertices, edges, and labels of the network stay unchanged during the loop. So, Constructor's 
possibilities for node creation and movement are not constricted. In the case we assume that Destructor 
must delete all of the m nodes to prevent Constructor from applying a relabehng rule, we obtain a winning 
strategy for Constructor since she would be able to move the strong node in the loop again and again, 
which would take her as many turns as Destructor needs for the node deletions (in this case Destructor 
would not be able to perform any other node deletion). 

Therefore, at least one of these m node deletions is needless for Destructor; we can ehminate it 
from Destructor's strategy without harming his strict winning strategy. (For the elimination step, we 
let Destructor successively delete the next weak node that he would delete by playing his strategy <7.) 
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Repeating this elimination for every case where Constructor can shift some strongness in networks of the 
same level in a loop, we can optimize Destructor's strict winning strategy to one where he additionally 
prevents for all i that any strongness is shifted more than n£ ■ dg times in networks of level £. □ 

So, for safety games where Destructor wins we obtained an upper bound of the length of the path 
along that a strongness is shifted within the same level. From this we can derive an upper bound for the 
number of node deletions that Destructor needs if he has a winning strategy. 

Lemma 3.4. Consider a safety game 5^ without weak creation rules. Let \V \ (\S\} be the number of active 
nodes (strong nodes) of the initial network. If Destructor wins ^, he also has a strict strategy to win ^ 
with at most \S\ ■ {2\V\ — \S\f' node deletions. 

Proof. Assume that Destructor wins the safety game The previous lemma states that Destructor also 
wins with a strict strategy where, for each Constructor can shift each strongness at most n^ ■ de times 
in networks of level i. Since the number of strong nodes is fixed. Destructor wins with a strict strategy 
where, for each £, he acts at most \S\-ni-de = \S\-n{-{ni — \S\—£) times in networks of level i. For strict 
strategies the level is monotonically decreasing (as long as it has not reached 0). The level decreases at 
most \V\ — \S\ times; so, < |V| + {\V\ — \S\) = 2\V\ — \S\ for every £. Hence, Destructor wins with a 
strict strategy deleting at most y}11q l*^! " " ("^ ~ l*^! ^ l^^l " — nodes. □ 

To show that the dynamic safety problem is in PSpace (if weak creation rules are forbidden) it 
suffices to build up the game tree, which we truncate after l^l • {2\V\ — \S\)^ moves of Destructor. We 
construct the game tree on-the-fly in a depth-first manner, so that we only have to store a path from the 
root to the current node, which length is polynomial in the size of 

Theorem 3.5. For games where Constructor does not have any weak creation rule, the dynamic safety 
problem is in PSpace. 

Another decidable subclass of the dynamic safety problem is the case where Constructor cannot 
move any strong node. Since Constructor is not able to restore any deleted node, we can ignore the 
deleted nodes in each network. Hence, we only have to explore are finite state space. 
Theorem 3.6. For games where Constructor does not have any movement rule, the dynamic safety 
problem is in ExpTlME. 

Proof sketch. Consider a safety game without movement rules. Due to Remark IT2] we can assume 
w.l.o.g. that Constructor plays according to a strict strategy. Then, the level decreases at most 1^1 — l^l 
times before Destructor wins or all nodes in the network are strong, where \V\ {\S\) is the number of 
active nodes (strong nodes) in the initial network. We transform 1^ into an infinite game fTSl on a game 
graph G' , where each vertex corresponds to a network of and the information which player acts next. 
When we ignore deleted nodes, the number of networks of the same level is at most exponential in 
Since the number of different levels is linear in the size of G' is at most exponential in and can 
be computed in exponential time. The dynamic safety problem for ^ is equivalent to the problem of 
determining the winner in the safety game on G' , which is decidable in hnear time ll26l[T3]| . □ 

Non-Expanding and Unlabeled Games. We already showed in Theorem 13.51 that we can solve the 
dynamic safety problem in PSPACE if weak creation rules are forbidden. This lower bound cannot be 
improved in the more restricted cases of non-expanding and unlabeled games since it has already been 
shown in |f20| that the dynamic safety problem is PSPACE-hard for unlabeled games. 
Theorem 3.7. For unlabeled games, the dynamic safety problem is PSPACE-hard. 

So, the dynamic safety problem is PSPACE-complete also for unlabeled and non-expanding games. 
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4 Results for Reachability Connectivity Games 

The General Case. The dynamic reachability problem is also undecidable in general. This has already 
been shown in 1201 for the variant where Constructor has to reach a biconnected network (instead of 
a connected network). The result also holds if we allow Constructor to use only strong creation and 
relabeling rules. Moreover, in the reachability game a Turing machine can be simulated solely by Con- 
structor who may connect a network if a stop state is reached, whereas in the safety game she has to 
simulate transitions in order to compensate Destructor's node deletions. As a consequence the undecid- 
ability of the dynamic reachability problem holds even for the solitaire game version where Destructor 
always decides to skip. One can easily adapt the proof of this result to the case where Constructor only 
has to establish a connected network. Alternatively, we can also use the idea of the proof of Theorem 13. II 
to relabel adjacent "cell nodes" with weak creation rules and guarantee with movement rules that only 
these two adjacent "cell nodes" are strong. 

Theorem 4.1. The dynamic reachability problem is undecidable, even if Constructor can only apply 
strong creation and relabeling rules or she can only apply weak creation and movement rules. In both 
cases the problem remains undecidable in the solitaire game version where Destructor never moves. 

Non-Expanding and Unlabeled Games. The proofs for the undecidability of the dynamic reachability 
problem for expanding games rely on the availability of creation moves; if these are omitted, the state 
space is finite and hence the problem becomes trivially decidable. 

Remark 4.2. For non-expanding games, the dynamic reachability problem is in ExpTlME. 
Complementary to this ExpTlME upper bound, we have a PS PACE lower bound. 

Theorem 4.3. For non-expanding games, the dynamic reachability problem is PSPACE-hard. 

This result is a variant of a result in ll20l . where the PS PACE-hardness has been shown for the question 
of whether Constructor can reach a network in which a certain label occur. It can be shown by a reduction 
from the sabotage game problem. 

In the unlabeled non-expanding case we give an NP lower bound and a PS PACE upper bound. 

Theorem 4.4. For unlabeled games, the dynamic reachability problem is NP-hard. 

Proof sketch. We use a polynomial-time reduction from the vertex cover problem. The basic idea is to 
use a graph, say Gyc, as a network G where the original vertices are taken as deactivated nodes and the 
original edges are taken as weak intermediate nodes; moreover, G consists of k strong nodes, which are 
connected to the deactivated nodes. If Constructor is able to connect G by moving these strong nodes to 
the deactivated nodes, those (formerly deactivated) nodes form a vertex cover in Gyc; and conversely, if 
Gvc has a vertex cover of size k, Constructor wins by moving the strong nodes to this vertex cover. □ 

Now, we establish a PSpace upper bound for the unlabeled case. The basic observation is that, if 
Constructor moves some strong node a certain number of times, she moves a strong node in a loop that 
cannot be necessary for a winning strategy. For this purpose, we first note an upper bound on the number 
of moves of a strong node; we know that after k-\V\ moves Constructor has shifted this strongness in 
some loop at least k times starting from a certain vertex. 

Remark 4.5. If Constructor shifts some strongness k-\V\ times, there is a vertex v £V that this strongness 
visits k+l times, i.e., the strongness is shifted through k loops that start and end at v. 
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We show that Constructor does not need to shift a strong node through more than 2 • |y| — 1 loops 
starting from the same vertex. Then we can infer from the previous remark that it is sufficient for 
Constructor to shift each strongness at most 2 • |y p — 1 times. 

Lemma 4.6. Consider an unlabeled reachability game ^ . If Constructor wins ^ , she also wins ^ with 
a strategy where she shifts each strongness at most 2 • |Vp — 1 times. 

Proof. Towards a contradiction, we assume that Constructor has a winning strategy a, but that Destructor 
has a strategy T such that Constructor has to shift some strongness at least 2 • |Vp times before she wins. 
Consider a play n where Destructor and Constructor play according to a and t, respectively. Then, 
the previous remark states that there is a vertex v G V from which Constructor moves some strongness 
through at least 2-\V\ loops before Constructor wins the play n. 

In a reachability game where only movement rules are allowed. Destructor cannot restrict Con- 
structor's possibilities to move. Hence, there are only two possible reasons for Constructor to shift the 
mentioned strong node in a loop that starts and ends at v. 

1. Some node of the loop, say u, is restored by shifting the strong node in that loop. However, in this 
case we can assume that Constructor does not restore u again while shifting the strongness in a 
loop that starts and ends at v. Otherwise Constructor can omit each former loop in which she shifts 
the strong node only for this reason; Constructor will still win with this modified strategy. 

2. Destructor deletes some node m G V \ {v}. Also in this case we can assume that Constructor does 
not move again this strongness in a loop that starts and ends at v while Destructor can ensure that 
the deletion of u is Constructor's only achievement (e.g., it may be that Destructor loses during 
this loop if he does not delete u). Otherwise the deletion of u in each former loop does not let 
Constructor establish a connected network. Hence, Constructor can omit each former loop in 
which she shifts the strong node only for this reason; again, she will still win with this strategy. 

Thus, we can assume that the first case occurs at most \V\ times and the second case occurs at most 
|V| — 1 times if Constructor plays optimal. Hence, we can optimize Constructor's winning strategy T 
to a winning strategy t' with which she shifts each strong node through at most 2 • |y| — 1 loops that 
start and end at the same vertex. This is a contradiction to our assumption that Constructor has to shift 
some strongness at least 2 • times; if this was the case it would follow from previous lemma that this 
strongness is shifted through at least 2-\V\ loops that start and end at the same vertex. □ 

We lift the upper bound for the number of moves of each strong node (in reachability games where 
Constructor wins) to the overall number of moves that Consti uctor needs to win. 

Lemma 4.7. Consider an unlabeled reachability game 'S where the network consists of |y | vertices, \S\ 
of which are strong. If Constructor wins Sf, she also has a strategy to win with at most 2-\S\-\y^ — \ 
moves. 

Proof. For connectivity games with reachability objective we can assume that Constructor never skips: 
if she skips, Destructor can skip as well leading the play to the same (disconnected) network. Since 
Constructor never skips, there exists a strongness that she shifts at least k times within \S\ ■ k moves. By 
Lemma l4!6l Constructor wins with2-|5Hy|2-l moves if she has a winning strategy. □ 

To show the decidabihty in PS PACE it suffices to build up the game tree, which we truncate after 
moves of Constructor (analogously to Theorem I3.5l l. 

Theorem 4.8. For unlabeled games, the dynamic reachability problem is decidable in PS PACE. 
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5 Perspectives 

We have introduced dynamic network connectivity games and studied the dynamic reachability and the 
dynamic safety problem for them. We showed that both problems are undecidable in general. However, 
restricting the permitted rule types we pointed out decidable fragments and encountered fundamental 
differences in the decidability and computational complexity of the reachability the safety version of the 
problem. As conclusion we mention some concrete open issues and possible refinements of the model. 

1. One can consider versions of the dynamic reachability and the dynamic safety problem where 
other subsets of the rules are allowed as considered in this paper. Some of these cases are trivial 
whereas others seem to be challenging: for instance the question of whether the dynamic safety 
problem is decidable if only relabeling rules are prohibited, or the question of whether the dynamic 
reachability problem is decidable if only creation rules are allowed. 

2. We have a gap between the upper and the lower bound for the complexity of solving non-expanding 
reachability games. We conjecture these are easier to solve in the unlabeled case as in the general 
non-expanding case; however, a proof is still missing. 

3. Some of our results depend on the balance of node deletion and restoration: if Constructor restores 
a node. Destructor can delete another one immediately. If one allows rules for multiple movements 
and relabelings in Constructor's turns, the complexity of the dynamic reachability and the dynamic 
safety problem increases. (In the non-expanding case, ExpTlME-completeness can be obtained via 
a reduction from the halting problem of polynomial space bounded alternating Turing machines.) 

4. We focused on reachability and safety specifications for the formal analysis of networks. In prac- 
tice one may consider a more involved recurrence (Biichi) condition, where Constructor has to 
reach a connected network again and again, or a persistence (co-BUchi) condition, where Con- 
structor has to guarantee that the network stays connected from some point onwards 1,13,1 . 

5. In the same way one may consider properties in linear temporal logic (LTL). A slight general- 
ization in the context of connectivity games are LTL-specifications over a single predicate that is 
true in turn / iff the current network is connected in turn /. For non-expanding games with such an 
LTL-condition an ExpTlME lower and a 2ExpTlME upper bound are known lITSl . 

6. It is rarely realistic to assume an omniscient adversary who deletes nodes; faults are better modeled 
as random events. This scenario has been studied in the framework of sabotage games ifTTl . One 
can study the corresponding case for dynamic network connectivity games, where Destructor is 
replaced by random vertex deletions [|15I . 

7. Another aspect is that yes/no questions as studied in this paper (i.e., whether a given specification 
is satisfied or not) have to be refined. From a practical point of view the formulation of an opti- 
mization problem is more useful, where we ask how many strong nodes are necessary to guarantee 
the network connectivity. For this optimization problem simple heuristics yield small (although 
not optimal) solutions with efficient winning strategies on various classes of networks lITSl . 

Acknowledgment. We thank a careful referee for his/her remarks on Lemma 13.3 l and Lemma l46l they 
helped to clarify the arguments. 
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